diff --git a/volatility3/framework/symbols/windows/versions.py b/volatility3/framework/symbols/windows/versions.py index 495655681..6b5b9846a 100644 --- a/volatility3/framework/symbols/windows/versions.py +++ b/volatility3/framework/symbols/windows/versions.py @@ -1,7 +1,7 @@ import logging -from typing import Callable, Tuple, List, Optional +from typing import Callable, List, Optional, Tuple -from volatility3.framework import interfaces, constants, exceptions +from volatility3.framework import constants, exceptions, interfaces vollog = logging.getLogger(__name__) @@ -187,6 +187,22 @@ is_win10_16299_or_later = OsDistinguisher( ], ) +is_win10_17134_or_later = OsDistinguisher( + version_check=lambda x: x >= (10, 0, 17134), + fallback_checks=[ + ("_EPROCESS", "ProcessFirstResume", True), + ("_EPROCESS", "HighMemoryPriority", True), + ], +) + +is_win10_10586_or_later = OsDistinguisher( + version_check=lambda x: x >= (10, 0, 10586), + fallback_checks=[ + ("_EPROCESS", "SecurityDomain", False), + ("_EPROCESS", "ImageFilePointer", False), + ], +) + is_win10_17763_or_later = OsDistinguisher( version_check=lambda x: x >= (10, 0, 17763), fallback_checks=[ @@ -218,6 +234,14 @@ is_win10_19041_or_later = OsDistinguisher( ], ) +is_win10_19577_or_later = OsDistinguisher( + version_check=lambda x: x >= (10, 0, 19577), + fallback_checks=[ + ("_EPROCESS", "PaeTop", False), + ("_EPROCESS", "IdealProcessorAssignmentBlock", True), + ], +) + is_win10_25398_or_later = OsDistinguisher( version_check=lambda x: x >= (10, 0, 25398), fallback_checks=[ @@ -235,6 +259,31 @@ is_windows_8_or_later = OsDistinguisher( version_check=lambda x: x >= (6, 2), fallback_checks=[("_HANDLE_TABLE", "HandleCount", False)], ) + +is_windows_7_sp0 = OsDistinguisher( + version_check=lambda x: x == (6, 1, 7600), + fallback_checks=[ + ("_EPROCESS", "VdmObjects", True), + ("_EPROCESS", "UmsScheduledThreads", False), + # Dropped after vista + ("_EPROCESS", "QuotaUsage", False), + # Added win8 + ("_EPROCESS", "WnfContext", False), + ], +) + +is_windows_7_sp1 = OsDistinguisher( + version_check=lambda x: x == (6, 1, 7601), + fallback_checks=[ + ("_EPROCESS", "VdmObjects", False), + ("_EPROCESS", "UmsScheduledThreads", True), + # Dropped after vista + ("_EPROCESS", "QuotaUsage", False), + # Added win8 + ("_EPROCESS", "WnfContext", False), + ], +) + # Technically, this is win7 or less is_windows_7 = OsDistinguisher( version_check=lambda x: x == (6, 1),